Privacy Policy
Last updated: September 30, 2026
What data Firma collects, what it is used for, who helps process it, how long it is kept, and your rights over it.
1. Data we collect
- Account data: name, email address, your password in hashed form, two-step verification settings and your chosen language.
- Company data: business profile, AI employees, tasks, documents, notes, approvals and the activity log.
- Customer data you connect: messages, contacts and orders from channels such as WhatsApp or email.
- Billing data: plan, payment history and AI credit usage. Card details are processed by Stripe directly; Firma does not store them.
- Technical data: IP address, device type and security logs. We use a sign-in cookie and a language cookie; visit statistics are counted without cookies, and we use no advertising trackers.
2. How we use data
We use data to run the service you ask for, keep accounts secure, bill you, help when you contact us, and improve Firma from combined usage statistics. We do not sell personal data and do not use your data to train AI.
3. Processing by AI providers
So that employees can work, the task and the material it needs are sent to the AI provider chosen for this Firma, only to produce the answer. AI keys are stored encrypted, and outside content is fenced so it is never treated as an instruction.
5. Subprocessors
This list will be completed with legal entity names and locations before general launch. We give notice before adding a new processor.
| Processor | Purpose | Location |
|---|---|---|
| Stripe | Payments and subscription billing | United States and European Union |
| AI providers (for example Anthropic, OpenAI, Google) | Producing answers and work for AI employees | Depends on the provider the admin chose |
| Hosting and database provider | Running the app and storing data | To be listed before launch |
| Email delivery provider | Verification, reminder and notification email | To be listed before launch |
| Sign in with Google and the Google connections you switch on | United States | |
| Meta (WhatsApp) | WhatsApp messages when you connect it | United States and European Union |
6. Data security
Passwords are stored with Argon2id, provider keys are encrypted with AES-256-GCM, sessions use httpOnly cookies, and sensitive actions ask you to verify again. Every outside action is recorded in an audit log that cannot be edited.
7. How long data is kept
Data is kept while your account is active. After an account is deleted, its data is removed from live systems within 30 days and from backups within 90 days. Billing records are kept as long as the law requires.
8. Your rights
Under Indonesia's Personal Data Protection Law and other applicable law, you may access, correct, export and delete your personal data, and withdraw consent. Most of this can be done yourself in Settings; for the rest, contact us.
If you use Firma to handle your customers' data, you are the controller of that data and Firma processes it on your instructions, as set out in the Data Processing Agreement.
9. Children and changes
Firma is not meant for anyone under 18. If this policy changes materially, we tell you by email or in the app.